SAYLOR The result you are building
A mint-specific authority report that identifies the token program and extensions, current mint/freeze/metadata/update/delegate/close authorities, ownership/control evidence, observed time, and limitations — without calling any token guaranteed safe.
Use this guide when: reviewing a Solana token before integration, listing, purchase, or risk report; explaining what authority fields can and cannot do.
Do not use it as a substitute for: trusting a token's symbol/name/logo to identify a mint, or interpreting a revoked mint authority as proof against liquidity, holder, metadata, delegate, or market risk.
Before you change anything, collect: cluster and exact mint address from an authoritative source; Token Program vs Token-2022 program and parsed mint/account data; metadata account/program and extensions; observed slot/time and independent RPC evidence.
Stop before proceeding if the mint/program cannot be resolved consistently across reliable sources, or a request asks for a seed/private key or an unknown signing transaction.
Understand the system before fixing it
- Authority value is a capability, not a prediction. A live mint authority can create supply; a freeze authority can freeze eligible accounts. Whether it *will* happen is unknown.
- Token-2022 extensions change the risk surface. Transfer hooks, fees, permanent delegates, default account state, confidential features and close authority all require program-specific decoding.
- Metadata identity is separate from mint economics. Update authority may change presentation; it does not necessarily control supply — and spoofed metadata can impersonate known brands.
Evidence-to-decision map
| Evidence | Likely layer | First decisive check | What the result means |
|---|---|---|---|
| Mint authority present | Supply | Decode authority type/address and owner/control | Additional minting may be possible; quantify current supply and disclose |
| Freeze authority present | Account control | Decode authority and token program semantics | Eligible token accounts may be frozen under program rules |
| Authority null | Revoked | Confirm parsed account from correct program/slot | That specific authority is unavailable; other controls still need review |
| Token-2022 extensions | Program behavior | List/decode every extension | Report transfer fee/hook/delegate/default/close implications individually |
| Metadata update authority | Presentation | Read metadata account and update authority | Name/symbol/URI content may be mutable; verify mint independently |
Step-by-step procedure
01. Resolve exact mint and program. Lookalike tokens share names and symbols. Confirm cluster/mint from the project and an independent explorer/RPC; fetch account owner to identify SPL Token vs Token-2022. Record slot/time and raw account hash/reference.
02. Decode base mint authorities. Read decimals, supply, initialization, mint authority and freeze authority with explicit null/present and address. Null means *that exact authority* is revoked, not that the token is safe. Compare two sources at nearby slots.
03. Decode extensions and delegates. Enumerate extensions — transfer fee/hook, permanent delegate, default state, metadata pointer, close authority, and others the deployed program supports — and identify control addresses. An unknown/unparsed extension lowers confidence.
04. Decode metadata/control provenance. Resolve the metadata account/program, URI, update authority, mutability, and collection/creator verification where applicable; fetch off-chain data cautiously with provenance. Never identify a token by logo alone — metadata can change or disappear.
05. Analyze controller addresses. Determine account type/owner, multisig threshold/signers when publicly decodable, PDA/program relationship, and upgrade-authority implications. Report unknown ownership rather than calling it renounced.
06. Issue a bounded report. Return the authority matrix, capabilities, evidence/slot/time, extensions, missing data, changes since a prior snapshot, confidence, and an explicit non-guarantee. Requery before any high-impact action — authorities can change.
Worked example
Starting problem: a token scanner says "mint revoked, safe."
Evidence collected: mint authority is null; freeze authority remains a live single-key address; metadata update authority is mutable; a Token-2022 permanent delegate is present.
Decision: the scanner checked one field and made an unsupported global conclusion.
Actions taken: decoded the correct token program and all extensions; reported each capability and controller separately; added holder/liquidity/market analysis as separate inputs.
Proof of completion: the report states minting is unavailable at the observed slot, but freeze/delegate/metadata controls remain — confidence, evidence, and the non-guarantee are explicit.
Why this matters: a trustworthy decoder never turns one revoked authority into a safety badge.
Verify, recover, and hand off
A report is complete only when: mint/cluster/program owner are exact and independently checked; base authorities and every supported extension are decoded; controller account type/ownership is reported or explicitly unknown; metadata authority/mutability/provenance are reported separately; observed slot/time/source and missing data are included; and no global safety guarantee is inferred.
If RPCs disagree, compare context/commitment/raw account against a third source. If the parser omits an extension, use a program-aware decoder or raw data and lower confidence. If an authority is a PDA, identify the owning program and its upgrade/control path — don't call it ownerless. If a metadata URL looks unsafe, don't click or sign; fetch it isolated and report provenance.
Reusable handoff record: mint/cluster/program/slot identity; authority and Token-2022 extension matrix; controller/multisig/program provenance; metadata/update/mutability evidence; capability explanations, missing data, confidence, and disclaimer.
For agents
This guide is well suited to being run as a repeatable, structured check before an agent acts on a token: feed it a mint address plus timestamped RPC evidence, and expect back an authority matrix (not a verdict), a confidence score based on how many independent observations back it, and explicit escalation when evidence is missing, contradictory, or too stale. Refuse to proceed on any input that would require a seed phrase, private key, or credential — none of this analysis ever needs one.
Official references: https://solana.com/docs/tokens/basics/set-authority · https://solana.com/docs/tokens/extensions · https://www.solana-program.com/docs/token-2022
*This is educational technical and risk-analysis information, not financial, investment, legal, or tax advice. Blockchain transactions can be irreversible and no checklist can guarantee safety or profit.*